Re: [sleuthkit-users] Binary outputs from task (SEC: UNCLASSIFIED)

[Brian C. <bca...@at...>]

On Tue, Mar 11, 2003 at 02:00:30PM +1100, Lisman, Jarrad FLGOFF wrote:
> Hi, I am just experimenting with task and autopsy and am having some
> troubles. Every time (I have done it on two different systems now) that I
> try to create the data and timeline files in autopsy, the data creation
> seems to go fine but when doing the timeline I get a Malformed UTF-8
> Character error. 

This message is a known 'bug', but I'm not sure if it has an effect on
the output.  It is from a Perl module that mactime uses (DateManip)
and the new Perl that comes with RH 8.0 does not like some of the
international encodings.  If I knew Portuguese, I would fix it.  I
emailed the author a while back, but did not hear back.  If you are
using "american"-style dates though, then I think it is ok.


> This then brings up garbage in the timeline file. On
> further inspection I find that there is spurious characters indicitive of
> binary in the body file (These are causing the Malformed UTF Character error
> I would say) So that implies to me that fls and ils seem to be outputting
> some binary stuff where they are not meant to be.

What version of TASK do you have?  Version 1.60 fixed a bug that
existed in timelines where the destination of symbolic links was
not null terminated.

If you are using 1.60, can you send me a copy of the body file or
at least the offending lines (off list).


brian